alert ip any tny,,2226,8,, -> any !ny (app-layer-event:applayer_mismatch_protocol_both_dirt:apount,!=ismatch_protocol_b.6.146.0/24,46.172.91.0/24,94.82.47.0/24,91.201.236.0/24,181.212.122.0/24,82.221.105.0/24,89.248.167.0/24,106.75.18.0/24,117.21.191.0/24,89.248.172.0/24] any -> $HOME_NET any (msg:"ET DROP Dshield Block Listed Source gmoup 1"; reference:url,feetxt; threshold: type limit, tracl,feetxt; threshold: type limit, track by_src, seconds 3600, count 1; classtype:mTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTUTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT-attack; f8;)
